I have the following string produced by a server log file. I am using Simple Event Correlator (which uses perl regex) to manipulate lines:
18:37:31 6220.127.116.11 sent /home/mydomain/public_html/court-954fdw/Chairman-confidential-video.mpeg 226 firstname.lastname@example.org 256
and I have been successful in using perl regex to successfully extract the user who logs in with the following pattern.
NOTE: the values that SEC uses are extracted from the data contained in the parenthesis:
However, I have been unsuccessful in parsing out just the file name which in this case would be:
Currently the existing pattern I use pulls out the entire string:
Chairman-confidential-video.mpeg 226 email@example.com 256
which I don't want. Any help much appreciated.